Re: [secdir] Secdir review of draft-ietf-tsvwg-port-randomization-06.txt

Fernando Gont <fernando@gont.com.ar> Thu, 04 March 2010 04:09 UTC

Return-Path: <fernando@gont.com.ar>
X-Original-To: secdir@core3.amsl.com
Delivered-To: secdir@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8867A28C4F5; Wed, 3 Mar 2010 20:09:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.481
X-Spam-Level:
X-Spam-Status: No, score=-3.481 tagged_above=-999 required=5 tests=[AWL=0.118, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TLu5m-HaGZ7G; Wed, 3 Mar 2010 20:09:20 -0800 (PST)
Received: from smtp1.xmundo.net (smtp1.xmundo.net [201.216.232.80]) by core3.amsl.com (Postfix) with ESMTP id 5A71928C235; Wed, 3 Mar 2010 20:09:18 -0800 (PST)
Received: from venus.xmundo.net (venus.xmundo.net [201.216.232.56]) by smtp1.xmundo.net (Postfix) with ESMTP id A5D766B6BB7; Thu, 4 Mar 2010 01:09:25 -0300 (ART)
Received: from [192.168.0.100] (129-130-17-190.fibertel.com.ar [190.17.130.129]) (authenticated bits=0) by venus.xmundo.net (8.13.8/8.13.8) with ESMTP id o2449FBb009462; Thu, 4 Mar 2010 01:09:16 -0300
Message-ID: <4B8F326C.4090804@gont.com.ar>
Date: Thu, 04 Mar 2010 01:09:16 -0300
From: Fernando Gont <fernando@gont.com.ar>
User-Agent: Thunderbird 2.0.0.23 (Windows/20090812)
MIME-Version: 1.0
To: Lars Eggert <lars.eggert@nokia.com>
References: <D80EDFF2AD83E648BD1164257B9B09120E1B46FD@TK5EX14MBXC115.redmond.corp.microsoft.com> <4B8CBEC1.1080203@gont.com.ar> <7E759E79-2154-476C-BD31-F8E0F1483D76@nokia.com>
In-Reply-To: <7E759E79-2154-476C-BD31-F8E0F1483D76@nokia.com>
X-Enigmail-Version: 0.96.0
OpenPGP: id=D076FFF1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by milter-greylist-3.0 (venus.xmundo.net [201.216.232.56]); Thu, 04 Mar 2010 01:09:25 -0300 (ART)
Cc: "gorry@erg.abdn.ac.uk" <gorry@erg.abdn.ac.uk>, "secdir@ietf.org" <secdir@ietf.org>, "micheal.larsen@tietoenator.com" <micheal.larsen@tietoenator.com>, "jmpolk@cisco.com" <jmpolk@cisco.com>, "iesg@ietf.org" <iesg@ietf.org>
Subject: Re: [secdir] Secdir review of draft-ietf-tsvwg-port-randomization-06.txt
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 04 Mar 2010 04:09:21 -0000

Hi, Lars,

> when you make some of the text changes that Charlie suggested, please
> make them in a way that doesn't break what the document says about
> [Allman]. (Mark Allman ran some tests with some of the algorithms in
> this document, and if we change their description retroactively, it
> may affect what we can say about his effort.)

I don't think the resulting changes would affect the results in
[Allman]. For instance, I'd bet the random() function he used provided
32-bit pseudo-random numbers (rathern than 16-bit numbers, as previously
suggested in the I-D).



>>> The document is titled "Transport Protocol Port Randomization 
>>> Recommendations", but it doesn't really make recommendations. It 
>>> enumerates current practice and calls out the pros and cons, but
>>> it doesn't really recommend what an implementer should do. That's
>>>  probably OK, but it seemed a bit odd.
> 
> this came up during the WG discussion. If I remember correctly, the
> document is the way it is because the WG felt that multiple schemes
> work well, and because this is not something that requires
> interoperability, there was no strong need to pick a "winner".

I didn't apply any change in response to this. (Just for the record, *I*
would have been happier with the document recommending a particular
algorithm... but I do see the point of why the wg didn't think so).

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: fernando@gont.com.ar || fgont@acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1